A method and system for providing secure cloud manufacturing services for the Industrial Internet of Things

Abstract

This invention relates to the field of industrial Internet of Things (IIoT) technology and discloses an IIoT cloud manufacturing security service method, comprising a cloud service provider, fog nodes, and a consortium blockchain. The method combines a dynamic elliptic curve vanstone implicit certificate and an elliptic curve integrated encryption scheme to establish a blockchain structure. When valid digital certificates are registered for the cloud, fog, and IoT nodes on the blockchain, a node is defined as a trusted IoT node. A symmetric key is established between the IoT-fog-cloud channel based on Diffie-Hellman key exchange. Elliptic curve non-interactive proofs based on Schnorr signatures ensure the anonymity and unlinkability of dynamic identities stored in the ledger, extending centralized storage to a distributed ledger and improving storage scalability. By using a dynamic elliptic curve vanstone implicit certificate and an elliptic curve integrated encryption scheme for the blockchain-based structure, a secure node service for trust establishment is provided.

Description

Technical Field

[0001] This invention relates to the field of industrial Internet of Things (IoT) technology, specifically to an industrial IoT cloud manufacturing security service method and system. Background Technology

[0002] The latest developments in the Industrial Internet of Things (IIoT) provide Industry 4.0 cloud computing integration for classic industrial manufacturing models. Cloud Manufacturing (CM) transforms traditional manufacturing models into customer-centric and service-oriented business architectures, enhancing the capabilities of manufacturing systems through cloud-based control and real-time process monitoring to improve factory efficiency.

[0003] With the development of the Internet of Things (IoT), components such as actuators and sensors in traditional production lines are being transformed into cyber-physical manufacturing systems connected to the cloud via the internet. While these systems possess intelligent capabilities, they inherit the vulnerability of the IoT to security threats. In the context of cloud manufacturing, existing technologies struggle to address security issues, such as the difficulty in establishing trust in manufacturing / monitoring equipment to ensure product authenticity, high latency, and future scalability requirements. Summary of the Invention

[0004] This invention primarily provides an industrial IoT cloud manufacturing security service method and system, addressing the challenges of establishing trust in manufacturing / monitoring equipment to ensure product authenticity in the context of cloud manufacturing, as well as the difficulties in meeting high latency and future scalability requirements of existing technologies.

[0005] To solve the above-mentioned technical problems, the present invention adopts the following technical solution:

[0006] An industrial IoT cloud manufacturing security service method includes a cloud service provider, fog nodes, and a consortium blockchain.

[0007] By combining dynamic elliptic curve implicit certificates and elliptic curve integrated encryption schemes to build a blockchain structure, when a valid digital certificate is registered for cloud, fog and IoT nodes on the blockchain, it will be defined as a trusted IoT node, providing trust-based secure node services.

[0008] Based on Diffie-Hellman key exchange, a symmetric key is established between the IoT-fog-cloud channel to encrypt sensitive information traffic of manufacturing equipment;

[0009] Elliptic curve non-interactive proofs based on Schnorr signatures extend centralized storage to distributed ledgers, establishing a shared key through key exchange to build secure communication channels.

[0010] Furthermore, when a valid digital certificate is registered for cloud, fog, and IoT nodes on the blockchain, it is defined as a trusted IoT node. The cloud, fog, and IoT node registration on the blockchain includes...

[0011] The user submits detailed information about the payment service;

[0012] The backend web server receives the request from the user and forwards it to the blockchain;

[0013] Within the blockchain, an algorithm is executed. The CSP-CA possesses both public and private keys. Upon successful bank response, the smart contract generates a certificate object and stores it in an extended storage space on the blockchain that stores address pointers. Within the certificate, the CSP-CA is responsible for each certificate's Cert... i Generate a random value r c-i Auxiliary parameter r aux-i The corresponding record for the certificate is BC-Cert. i In the blockchain ledger storage, the key value of each element is H(ID). i ,i*w)G, the value is the index of the extended storage, which is actually the hash of the certificate object in the extended storage;

[0014] Where H is the hash function, w is the private value generated for a client, and i is the index, indicating which session, i = [1, n].

[0015] Furthermore, the establishment of a symmetric key based on Diffie-Hellman key exchange between the IoT-fog-cloud channel to encrypt sensitive information traffic from manufacturing equipment includes,

[0016] In the key initialization phase of the manufacturing equipment, during each key exchange process, the IoT node generates a private key based on the auxiliary data stored in the ledger of key exchange i. The cloud node needs to synchronize with counter i and dynamic identity and send the IoT node to the fog node to start the key exchange.

[0017] Furthermore, the elliptic curve non-interactive proof based on Schnorr signatures ensures the anonymity and unlinkability of dynamic identities stored in the ledger, extending centralized storage to distributed ledgers and improving storage scalability. The Schnorr signature includes...

[0018] The message M is signed using a key pair (dn, Qn), where dn is the key and Qn is the public key, and Qn = dn * G, where G is a randomly selected point on the ellipse. The user selects a random value r and calculates R = rG, deriving the function h = H(M, R), where H is a one-way collision-resistant hash function. The signature is defined as s = r - hd. nThe user publicly discloses M, R, and s together, where M is the message, R is the intermediate value for verifying the signature, and s is the signature. Other parameters can be determined using the equation sG = RH(M, R)Q. n The verification message M is signed by the user using a public key, if the equation sG = RH(M, R)Q n If the result is valid, the verification is considered successful.

[0019] Furthermore, if a certificate is generated on the IoT device, then it will be used in the dynamic ID. i The counter i is synchronized with the cloud node to establish a public symmetric key;

[0020] CSP receives message M4 from the fog node and verifies the signature s. f If M4 and s f If the signature does not match, a signature verification error will be returned and the smart contract will be terminated.

[0021] If the signature is correct, extract C2 and C3, and use the public key Q. c =d c G, the d c Q is the private key, and Q is the public key. C Convert the corresponding symmetric key K c-1 =d c *A c-1 =d c *r c-1 *G and K c-2 =d c *A c-2 =d c *r c-2 *G, Confidential Decryption C c-1 and C c-2 C2 and C3 will be encrypted and sent to the cloud, where a signature s will be generated using the Schnorr signature scheme. f Generate message M4 to be forwarded to the cloud;

[0022] Where, C2={C c-1 A c-1}, A c-1 =r c-1 G, According to ECIES, IoT nodes generate random values ​​r c-1 ;

[0023] C3={C c-2 A c-2}, A c-1 =r c-2 G, Encrypt Hash via Fog Node-CSP Channel i Similarly, according to ECIES, a random value r will be generated in the fog node. c-2 ;

[0024] M4 = <{C2, C3}, s f >

[0025] An industrial IoT cloud manufacturing security service system includes,

[0026] The blockchain establishment module is used to combine dynamic elliptic curve vanstone implicit certificates and elliptic curve integrated encryption schemes to establish a blockchain structure. When a valid digital certificate is registered on the blockchain for cloud, fog and IoT nodes, it will be defined as a trusted IoT node, providing trusted establishment of secure node services.

[0027] The symmetric key establishment module is used to establish symmetric keys between IoT-fog-cloud channels based on Diffie-Hellman key exchange, thereby encrypting sensitive information traffic from manufacturing equipment.

[0028] A secure communication channel building module is used for elliptic curve non-interactive proofs based on Schnorr signatures, extending centralized storage to a distributed ledger, establishing a shared key through key exchange, and building a secure communication channel.

[0029] Furthermore, the blockchain establishment module includes,

[0030] The blockchain includes cloud, fog, and IoT node registration units. The user submits detailed payment service information; the backend web server receives the user's request and forwards it to the blockchain; the corresponding algorithm is executed on the blockchain; the CSP-CA possesses the public and private keys; after the bank's successful response, the smart contract generates a certificate object and stores it in an extended storage location on the blockchain containing address pointers. In the certificate, the CSP-CA is the certificate holder for each certificate. i Generate a random value r c-i Auxiliary parameter r aux-i The corresponding record for the certificate is BC-Cert. i In the blockchain ledger storage, the key value of each element is H(ID). i ,i*w)G, the value is the index of the extended storage, which is actually the hash of the certificate object in the extended storage;

[0031] Where H is the hash function, w is the private value generated for a client, and i is the index, indicating which session, i = [1, n].

[0032] Furthermore, the symmetric key establishment module includes,

[0033] In the key initialization phase of the manufacturing equipment, during each key exchange process, the IoT node generates a private key based on the auxiliary data stored in the ledger of key exchange i. The cloud node needs to synchronize with counter i and dynamic identity and send the IoT node to the fog node to start the key exchange.

[0034] Furthermore, the secure communication channel construction module includes,

[0035] A Schnorr signature unit is used to sign a message M. It has a key pair (dn, Qn), where dn is the key and Qn is the public key, and Qn = dn * G, where G is a randomly selected point on an ellipse. The user selects a random value r and calculates R = rG. The derived function is h = H(M, R), where H is a one-way collision-resistant hash function. The signature is defined as s = r - hd. n The user publicly discloses M, R, and s together, where M is the message, R is the intermediate value for verifying the signature, and s is the signature. Other parameters can be determined using the equation sG = RH(M, R)Q. n The verification message M is signed by the user using a public key, if the equation sG = RH(M, R)Q n If the result is valid, the verification is considered successful.

[0036] Furthermore,

[0037] The cloud synchronization and key establishment unit is used to generate certificates on the IoT device, and then in the dynamic ID. i The counter i is synchronized with the cloud node to establish a public symmetric key;

[0038] CSP receives message M4 from the fog node and verifies the signature s. f If M4 and s f If the signature does not match, a signature verification error will be returned and the smart contract will be terminated.

[0039] If the signature is correct, extract C2 and C3, and use the public key Q. c =d c G, the d c Q is the private key, and Q is the public key. C Convert the corresponding symmetric key K c-1 =d c *A c-1 =d c *r c-1 *G and K c-2 =d c *A c-2 =d c *r c-2 *G, Confidential Decryption C c-1 and C c-2 C2 and C3 will be encrypted and sent to the cloud, where a signature s will be generated using the Schnorr signature scheme.f Generate message M4 to be forwarded to the cloud;

[0040] Where, C2={C c-1 A c-1}, A c-1 =r c-1 G, According to ECIES, IoT nodes generate random values ​​r c-1 ;

[0041] C3={C c-2 A c-2}, A c-2 =r c-2 G, Encrypt Hash via Fog Node-CSP Channel i Similarly, according to ECIES, a random value r will be generated in the fog node. c-2 ;

[0042] M4 = <{C2, C3}, s f >

[0043] Beneficial effects: This invention provides a secure node service for trust establishment for a blockchain-based structure by using dynamic elliptic curve vanstone implicit certificates and elliptic curve integration with circular encryption schemes. On the other hand, it constructs symmetric keys between IoT-fog-cloud channels based on Diffie-Hellman key exchange to encrypt sensitive information traffic from manufacturing devices, thereby ensuring the anonymity and unlinkability of dynamic identities stored in the ledger. At the same time, using fog nodes moves security services to the edge, eliminating the impact of central failures, reducing message latency, and improving the performance of the security service system. Attached Figure Description

[0044] Figure 1 A schematic diagram of the process flow for providing security services for cloud manufacturing in the Industrial Internet of Things (IIoT).

[0045] Figure 2 A schematic diagram of the distribution of an industrial IoT cloud manufacturing security service system;

[0046] Figure 3 A schematic diagram of the process distribution for an industrial IoT cloud manufacturing security service system. Detailed Implementation

[0047] The following will provide a more detailed description of the technical solution of the industrial Internet of Things cloud manufacturing security service method and system involved in this invention, with reference to the embodiments.

[0048] See Figure 1 and Figure 3 An industrial IoT cloud manufacturing security service method includes a cloud service provider, fog nodes, and a consortium blockchain.

[0049] S1 combines dynamic elliptic curve vanstone implicit certificates and elliptic curve integrated encryption schemes to establish a blockchain structure. When a valid digital certificate is registered for cloud, fog and IoT nodes on the blockchain, it will be defined as a trusted IoT node, providing trust-based secure node services.

[0050] See Figure 3 Specifically, the industrial IoT cloud manufacturing security service method includes using dynamic elliptic curve Vanstone implicit certificates for IoT devices. When a valid digital certificate is registered on the blockchain for each session, it is defined as a trusted IoT node. Simultaneously, a symmetric key is established between IoT, fog, and cloud nodes to encrypt sensitive information related to manufacturing operations. These two methods minimize the risk of encryption and authentication key leakage.

[0051] The entire system architecture integrates blockchain and fog computing. Specific components include: a cloud service provider with digital and intelligent product design, manufacturing specifications, and process monitoring capabilities; manufacturing equipment, acting as actuators and sensors in the manufacturing process, which will be referred to as IoT nodes; fog nodes, connecting IoT nodes to the cloud and acting as blockchain nodes responsible for performing security-related operations; and a consortium blockchain, a federation of CSPs and independent manufacturing equipment clusters. Each fog node and CSP operates as a complete blockchain node, executing transactions submitted to the ledger and generating consensus. ECQV certificates and ECIES encryption algorithms register IoT, fog nodes, and cloud nodes on the blockchain. Then, key exchange occurs between IoT and fog nodes, and between fog nodes and cloud nodes, establishing a shared key to build secure communication channels.

[0052] The Elliptic Curve Integrated Cryptography (ECIES) encryption algorithm works as follows: the sender generates a random value r and calculates A = rG, where G is a randomly selected point on the elliptic curve, and the symmetric session key is defined as K = rQ. R , where Q R A is the public key; A and K are the ciphertext C generated by encrypting with the public key. This ciphertext is a dot pair, C = {A, M + K}.

[0053] The symmetric session key is defined as K = rQ R It can be received by the receiver via K=d R A = rQ R Calculate that, where Q R It is the public key, d R, It's the private key; the recipient knows Q. R =d R G's private key d R Thus, the sender can use the public key QR The message M is encrypted and sent to the recipient, who then decrypts it to obtain the plaintext message.

[0054] For manufacturing equipment α, the user terminal will generate a private value w, ID authentication ID-Cert i Certificate authentication record set I on the blockchain α As shown in the following formula.

[0055] ID-Cert i =H(ID) i ,i*w)G

[0056] I α ={ID-Cert i , ..., ID-Cert n};

[0057] Where H is the hash function, w is the private value generated for a client, and i is the index, indicating which session, i = [1, n].

[0058] S2, based on Diffie-Hellman key exchange, establishes a symmetric key between the IoT-fog-cloud channel to encrypt sensitive information traffic of manufacturing equipment;

[0059] Specifically, the Cloud Service Provider-Certification Authority (CSP-CA) possesses the public key Q. c =d c G and the privately stored key d c Fog nodes register with H(ID) on the blockchain. f d f Q c The address corresponding to ) d f Stored in the fog node, ID f It is the identifier of the fog node, enabling payment verification in each session. CSP-CA is a sub-component of CSP, invoked by the CSP's local blockchain nodes. Unlike a centralized CA, it does not handle end-to-end certificate management operations.

[0060] The registration process for cloud, fog, and IoT nodes on the blockchain is as follows:

[0061] The user submits detailed information about the payment service;

[0062] The backend web server receives the request from the user and forwards it to the blockchain;

[0063] Within the blockchain, a corresponding algorithm is executed. The CSP-CA possesses both public and private keys. After the bank's successful response, the smart contract generates a certificate object and stores it in an extended storage space on the blockchain that stores address pointers. In the certificate, the CSP-CA is designated as the certificate holder for each certificate.i Generate a random value r c-i Auxiliary parameter r aux-i The corresponding record for the certificate is BC-Cert. i In the blockchain ledger storage, the key value of each element is H(ID). i ,i*w)G, where the value is the index of the extended storage, which is actually the hash of the certificate object in the extended storage; the formula is as follows.

[0064] Cert i =H(ID) i ,i*w)G+r c-i *G

[0065] r aux-i =H(H(ID) i ,i*w)G,Cert i )r c-i +d c

[0066] BC-Cert i = <ID-Cert i Cert i r aux-i Timestamp

[0067] Finally, in the blockchain ledger storage, the key value of each element is H(ID). i The value is an index of the extended storage, which is actually a hash of the certificate object in the extended storage. Elements in the certificate object include the storage key, certificate, counter data, auxiliary data generated by the private key, the ZKP dataset, and its curve points. Hash processing transfers storage overhead to the extended storage, improving the scalability of the ledger storage.

[0068] Specifically, in the key initialization phase of the manufacturing equipment, during each key exchange, the IoT node generates a private key based on auxiliary data stored in the ledger of key exchange i. The cloud node needs to combine this private key with counter i and dynamic identity ID. i Synchronization: The IoT node sends M1 to the fog node to initiate key exchange.

[0069] Message M1 consists of ciphertext C1 and C2. C1 includes encrypted certificate authentication, and C2 includes a tuple containing an encrypted dynamic identity and a counter. Public key Q is used. f =d f G and private key d f d fFog nodes registered in the ledger are stored as private nodes. C1 decrypts the data at the fog node to retrieve the certificate object stored in the ledger. According to ECIES, the IoT node generates a random value r. f symmetric key K f =r f Q f The definition of C1 is shown below.

[0070] C1={C f A f}

[0071] A f =r f G

[0072]

[0073] Similar to fog nodes, cloud nodes use the public key Q. c =d c G registration will also be stored as a private node. C2 will decrypt it at the cloud node to synchronize the counter i and the dynamic identity ID. i According to ECIES, IoT nodes generate random values ​​r. c-1 symmetric key K c-1 =r c-1 Q c The definition of C2 is shown below.

[0074] C2={C c-1 A c-1}

[0075] A c-1 =r c-1 G

[0076]

[0077] In the certificate verification phase of the blockchain nodes within the fog layer, the fog node acts as a gateway for IoT nodes, connecting to the cloud node via the internet. Simultaneously, it also functions as a node in a consortium blockchain, executing smart contracts for security services. Through the fog node, deployed smart contracts can be used to perform operations such as certificate generation, access the fog node's private storage locally, and obtain the CA's private key.

[0078] S3, based on Schnorr signatures and elliptic curve non-interactive proofs, extends centralized storage to distributed ledgers and establishes a shared key through key exchange to build a secure communication channel.

[0079] Specifically, the Schnorr signature scheme is used to sign the message M, which has a key pair d. n Q n=d n The user G selects a random value r and calculates R = rG, deriving h = H(M, R), where R is a random point on an elliptic curve that is simultaneously encrypted by r, and H is a one-way collision-resistant hash function with the signature defined as s = rh d. n Then, the user publishes messages M, R, and s together, and other parties can access them via the equation sG = RH(M, R)Q. n The verification message M is generated by the user using the public key Q. n If the equation is true, the verification is considered successful.

[0080] Digital Certificate (H(ID)) i The authentication of C1 (i*w)G is encrypted via the IoT-fog node channel in message M1, and the fog node can decrypt C1 according to the ECIES decryption scheme. Based on the elliptic curve non-interactive proof of Schnorr signature, the smart contract generates a symmetric key K. f =d f A f =r f Q f Thus decrypting C f And export the authentication of the digital certificate on the blockchain (H(ID)). i The smart contract retrieves the certificate object CertObj from the extended storage. i For H(ID) i The i*w) value is validated to verify whether the requested IoT meets expectations and holds the correct private value.

[0081] Similarly, it is necessary to prove that the ledger record contains i without exposing any information about i to the smart contract being verified, and to verify the anonymity and unlinkability of the certificate. The ledger record of the certificate includes the generated elliptic curve point P. i The randomly generated r i A i =r i G, B i =iG,c i and s i =r i +c i x i .

[0082] Smart contracts calculate c based on ledger records. i =H(x) i P i r i P i A i ), and verify s i G = A i +c i Bi and s i P i =r i P i +c i x i P i This checks if the counter is correctly synchronized to verify its validity. If the verification is successful, the smart contract will calculate the hash. i It checks if the value exists in the ledger to prevent certificate reuse. If it doesn't exist, the ledger will match the hash. i They are stored together in a hash table within it. Because this table contains irreversible hash values ​​calculated based on private data, anonymity and unlinkability are ensured. If such a hash exists, the smart contract will terminate its execution and return a failure.

[0083] Hash i =H(d) f *H(ID i ,i*w)G mod p)

[0084] If the response is valid, the fog node will send the message M2=CertObj to the IoT node. i To generate a certificate, including its auxiliary data (aux). i and derived private key d i The definition is as follows.

[0085] aux i =H(H(ID) i ,i*w)G,Cert i )r c-i +d c

[0086] d i =H(H(ID) i ,i*w)G,Cert i )G(ID i ,i*w)+aux i

[0087] In addition, the IoT node will generate a public key (pubKey) for key exchange i. i and symmetric key symKey i This symmetric key will be used in the IoT-CSP channel. Message M3, including the public key and symmetric key, will be sent to the fog node smart contract. The hash value H (symKey) i It will be stored in the ledger to ensure that the symKey in the CSP is secure. i Consistency is defined as follows.

[0088] pubKey i =di *G mod p

[0089] symKey i =H(pubKey) i *d c )

[0090] M3 = <pubKey i H(symKey) i )>

[0091] Encrypt Hash via Fog Node-CSP Channel i Similarly, according to ECIES, a random value r will be generated in the fog node. c-2 symmetric key K c-2 =r c-2 Q c The definition of C3 is shown below.

[0092] C3={C c-2 A c-2}

[0093] A c-2 =r c-2 G

[0094]

[0095] C2 and C3 will be encrypted and sent to the cloud, where a signature s will be generated using the Schnorr signature scheme. f Generate message M4 to be forwarded to the cloud. M4 is defined as follows.

[0096] M4 = <{C2, C3}, s f >

[0097] Once a certificate is generated on the IoT device, it needs to be applied to the dynamic ID. i The counter i is synchronized with the cloud node to establish a public symmetric key. The specific steps are as follows: The CSP receives message M4 from the fog node and verifies the signature s. f If they don't match, a signature verification error will be returned and the smart contract will be terminated. If the signature is correct, C2 and C3 will be extracted and processed using the public key Q. c =d c C, convert the corresponding symmetric key K c-1 =d c *A c-1 =d c *r c-1 *G and K c-2 =d c *A c-2 =d c *r c-2*G, Confidential Decryption C c-1 and C c-2 .

[0098] Where DKc-1 represents the decryption function;

[0099]

[0100] The smart contract checks whether the ledger contains a hash. i This ensures that fog node verification was performed previously on the i-th key exchange. If the ledger contains a hash... i Then a secondHash will be generated. i And check secondHash i Check if the certificate is in the ledger to ensure it hasn't been used twice. If it is, the contract terminates and returns an error. If not, it means the certificate hasn't been used before, and the secondHash will be used. i Add to the ledger.

[0101] secondHash i =H(d) c *H(ID i ,i))

[0102] Similarly, the symkey between IoT-CSP channels i =H(d) c *Q i The mod p) will be used for data exchanged between the IoT node and the CSP after the encryption key exchange i. The smart contract checks the symKey before synchronizing the dynamic ID and counter. i If the key is not in the ledger, the smart contract will return an invalid key error and terminate.

[0103] After successfully completing all these steps, each IoT node possesses the latest generated dynamic ECQV certificate for the i-th session, the public / private key for each session, and a symmetric key with the cloud. The ledger contains pointers to the ECQV certificates, hashes of the public keys, and the symmetric key. The CSP has the verified public key and symmetric key of the IoT nodes, and the IoT and CSP can use the symmetric key established in the previous steps to communicate securely.

[0104] See Figure 2 An industrial IoT cloud manufacturing security service system includes,

[0105] Blockchain Establishment Module 01 is used to combine dynamic elliptic curve vanstone implicit certificates and elliptic curve integrated encryption schemes to establish a blockchain structure. When a valid digital certificate is registered for cloud, fog and IoT nodes on the blockchain, it will be defined as a trusted IoT node, providing trusted establishment of secure node services.

[0106] Symmetric key establishment module 02 is used to establish a symmetric key between the IoT-fog-cloud channel based on Diffie-Hellman key exchange, and to encrypt the sensitive information traffic of manufacturing equipment.

[0107] The Secure Channel Construction Module 03 is used for elliptic curve non-interactive proofs based on Schnorr signatures to ensure the anonymity and unlinkability of dynamic identities stored in the ledger, extending centralized storage to distributed ledgers and improving storage scalability.

[0108] Furthermore, the blockchain establishment module 01 includes,

[0109] The cloud, fog, and IoT node registration unit 04 on the blockchain allows users to submit detailed payment service information. The backend web server receives the user's request and forwards it to the blockchain. A corresponding algorithm is executed on the blockchain. The CSP-CA possesses both public and private keys. Upon successful bank response, the smart contract generates a certificate object and stores it in an extended storage location on the blockchain containing address pointers. The CSP-CA is the certificate holder for each certificate. i Generate a random value r c-i Auxiliary parameter r c-i The corresponding record for the certificate is BC-Cert. i In the blockchain ledger storage, the key value of each element is H(ID). i The value is an index of the extended storage, which is actually the hash of the certificate object in the extended storage.

[0110] Furthermore, the symmetric key establishment module 02 includes,

[0111] In the key initialization phase of the manufacturing equipment, during each key exchange process, the IoT node generates a private key based on the auxiliary data stored in the ledger of key exchange i. The cloud node needs to synchronize with counter i and dynamic identity and send the IoT node to the fog node to start the key exchange.

[0112] Furthermore, the secure channel construction module includes,

[0113] Schnorr signature unit 05, used to sign message M, has a key pair d. n Q n =dn The user G selects a random value r and calculates R = rG, deriving h = H(M, R), which is a one-way collision-resistant hash function, and its signature is defined as s = r - hd. n Users publish messages M, R, and s together, and other parties can access them via the equation sG = RH(M, R)Q. n The verification message M is signed by the user using a public key.

[0114] Furthermore, the cloud synchronization and key establishment unit 06, which generates a certificate at the IoT terminal, is used in the dynamic ID... i The counter i is synchronized with the cloud node to establish a public symmetric key;

[0115] CSP receives message M4 from the fog node and verifies the signature s. f If M4 and s f If the signature does not match, a signature verification error will be returned and the smart contract will be terminated.

[0116] If the signature is correct, extract C2 and C3, and use the public key Q. c =d c G, the d c Q is the private key, and Q is the public key. C Convert the corresponding symmetric key K c-1 =d c *A c-1 =d c *r c-1 *G and K c-2 =d c *A c-2 =d c *r c-2 *G, Confidential Decryption C c-1 and C c-2 C2 and C3 will be encrypted and sent to the cloud, where a signature s will be generated using the Schnorr signature scheme. f Generate message M4 to be forwarded to the cloud;

[0117] Where, C3={C c-1 A c-1}, A c-1 =r c-1 G, According to ECIES, IoT nodes generate random values ​​r c-1 ;

[0118] C3={C c-2 A c-2}, A c-2 =r c-2 G, Encrypt Hash via Fog Node-CSP Channel iSimilarly, according to ECIES, a random value r will be generated in the fog node. c-2 ;

[0119] M4 = <{C2, C3}, s f >

[0120] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the above-described division of functional units and modules is used as an example. In practical applications, the above functions can be assigned to different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above. The functional units and modules in the embodiments can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit. Furthermore, the specific names of the functional units and modules are only for easy differentiation and are not intended to limit the scope of protection of this application. The specific working process of the units and modules in the above system can be referred to the corresponding process in the foregoing method embodiments, and will not be repeated here.

[0121] In the above embodiments, the descriptions of each embodiment have different focuses. For parts that are not described in detail or recorded in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0122] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this disclosure.

[0123] In the embodiments provided in this disclosure, it should be understood that the disclosed apparatus / computer devices and methods can be implemented in other ways. For example, the apparatus / computer device embodiments described above are merely illustrative. For instance, the division of modules or units is only a logical functional division, and in actual implementation, there may be other division methods. Multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the mutual coupling or direct coupling or communication connection shown or discussed may be through some interfaces, and the indirect coupling or communication connection between apparatuses or units may be electrical, mechanical, or other forms.

[0124] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0125] Furthermore, the functional units in the various embodiments of this disclosure can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated units can be implemented in hardware or as software functional units. If the integrated module / unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, all or part of the processes in the methods of the above embodiments of this disclosure can also be implemented by a computer program instructing related hardware. The computer program can be stored in a computer-readable storage medium, and when executed by a processor, it can implement the steps of the various method embodiments described above. The computer program can include computer program code, which can be in the form of source code, object code, executable files, or certain intermediate forms. The computer-readable medium can include: any entity or device capable of carrying computer program code, recording media, USB flash drives, portable hard drives, magnetic disks, optical disks, computer memory, read-only memory (ROM), random access memory (RAM), electrical carrier signals, telecommunication signals, and software distribution media, etc. It should be noted that the content contained in computer-readable media may be appropriately added to or subtracted from the requirements of legislation and patent practice in a jurisdiction. For example, in some jurisdictions, computer-readable media may not include electrical carrier signals and telecommunication signals, in accordance with legislation and patent practice.

[0126] The above embodiments are only used to illustrate the technical solutions of this disclosure, and are not intended to limit it. Although this disclosure has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this disclosure, and should all be included within the protection scope of this disclosure.

Claims

1. A method for providing secure cloud manufacturing services for the Industrial Internet of Things (IIoT), characterized in that, This includes cloud service providers, fog nodes, and consortium blockchains. By combining Dynamic Elliptic Curve Implicit Certificates (VFSIC) and the Elliptic Curve Integrated Encryption Scheme (ECIES) to build a blockchain structure, when valid digital certificates are registered on the blockchain for cloud, fog, and IoT nodes, they are defined as trusted IoT nodes, providing trusted and secure node services. Certificates generated at the IoT end are then used in the Dynamic ID... i The counter i is synchronized with the cloud node to establish a public symmetric key; Cloud service provider (CSP) receives messages from fog nodes. Verify signature ,like and If there is a mismatch, a signature verification error will be returned and the smart contract will be terminated; If the signature is correct, extract. and and using public key The d c Q is the private key, and Q is the public key. C Convert the corresponding symmetric key and Confidential Declassification and ; and It will be encrypted and sent to the cloud, where a signature will be generated using the Schnorr signature scheme. Generate messages to be forwarded to the cloud. ; in, , , According to ECIES, IoT nodes generate random values. ; , , Encryption via fog node-CSP channel Similarly, according to ECIES, random values ​​will be generated in the fog nodes. ; ； Based on Diffie-Hellman key exchange, a symmetric key is established between the IoT-fog-cloud channel to encrypt sensitive information traffic of manufacturing equipment; Elliptic curve non-interactive proofs based on Schnorr signatures extend centralized storage to distributed ledgers, establishing a shared key through key exchange to build secure communication channels.

2. The industrial IoT cloud manufacturing security service method according to claim 1, characterized in that, When a cloud, fog, and IoT node registers a valid digital certificate on the blockchain, it is defined as a trusted IoT node. The registration of cloud, fog, and IoT nodes on the blockchain includes... The user submits detailed information about the payment service; The backend web server receives the request from the user and forwards it to the blockchain; Within the blockchain, an algorithm is executed. The Cloud Service Provider-Certification Authority (CSP-CA) possesses the public and private keys. After the bank's successful response, the smart contract generates a certificate object and stores it in an extended storage space on the blockchain that stores address pointers. The CSP-CA is the Cloud Service Provider for each certificate. Generate a random value Auxiliary parameters The corresponding record for the certificate is In the blockchain ledger storage, each element's key value is... The value is the index of the extended storage, which is actually the hash of the certificate object in the extended storage; Where H is the hash function, w is the private value generated for a client, and i is the index, indicating which session, i=[1,n].

3. The industrial IoT cloud manufacturing security service method according to claim 1, characterized in that, The method of establishing a symmetric key between the IoT-fog-cloud channel based on Diffie-Hellman key exchange to encrypt sensitive information traffic of manufacturing equipment includes, In the key initialization phase of the manufacturing equipment, during each key exchange process, the IoT node generates a private key based on the auxiliary data stored in the ledger of key exchange i. The cloud node needs to synchronize with counter i and dynamic identity and send the IoT node to the fog node to start the key exchange.

4. The industrial IoT cloud manufacturing security service method according to claim 1, characterized in that, The elliptic curve non-interactive proof based on Schnorr signatures ensures the anonymity and unlinkability of dynamic identities stored in the ledger, extending centralized storage to distributed ledgers and improving storage scalability. The Schnorr signature includes... The message M is signed using a key pair (dn, Qn), where dn is the key and Qn is the public key, and Qn = dn * G, where G is a randomly selected point on the ellipse. The user selects a random value r and calculates... Exported functions H is a one-way collision-resistant hash function, and its signature is defined as follows: The user publicly discloses M, R, and s together, where M is the message, R is the intermediate value for verifying the signature, and s is the signature. Other parameters can be determined using equations. The verification message M is signed by the user using a public key, if the equation... If the result is valid, the verification is considered successful.

5. An industrial IoT cloud manufacturing security service system, characterized in that, include, The blockchain establishment module is used to combine dynamic elliptic curve vanstone implicit certificates and the elliptic curve integrated encryption scheme ECIES to establish a blockchain structure. When a valid digital certificate is registered on the blockchain for cloud, fog and IoT nodes, it will be defined as a trusted IoT node, providing a trusted establishment of secure node services. The symmetric key establishment module is used to establish symmetric keys between the IoT-fog-cloud channel based on Diffie-Hellman key exchange, encrypting sensitive information traffic from manufacturing equipment; a certificate is generated at the IoT end, and then... (The sentence is incomplete and requires more context to translate accurately.) i The counter i is synchronized with the cloud node to establish a public symmetric key; Cloud service provider (CSP) receives messages from fog nodes. Verify signature ,like and If there is a mismatch, a signature verification error will be returned and the smart contract will be terminated; If the signature is correct, extract. and and using public key The d c Q is the private key, and Q is the public key. C Convert the corresponding symmetric key and Confidential Declassification and ; and It will be encrypted and sent to the cloud, where a signature will be generated using the Schnorr signature scheme. Generate messages to be forwarded to the cloud. ; in, , , According to ECIES, IoT nodes generate random values. ; , , Encryption via fog node-CSP channel Similarly, according to ECIES, random values ​​will be generated in the fog nodes. ; ； The secure communication channel construction module is used for elliptic curve non-interactive proofs based on Schnorr signatures to extend centralized storage to a distributed ledger. It establishes a shared key through key exchange and builds a secure communication channel.

6. The industrial IoT cloud manufacturing security service system according to claim 5, characterized in that, The blockchain establishment module includes, The cloud, fog, and IoT node registration unit on the blockchain allows users to submit detailed payment service information. A backend web server receives the user's request and forwards it to the blockchain. Within the blockchain, a corresponding algorithm is executed. The cloud service provider-certification authority (CSP-CA) possesses the public and private keys. After a successful bank response, the smart contract generates a certificate object and stores it in an extended storage location on the blockchain containing address pointers. The CSP-CA is the identifier for each certificate. Generate a random value Auxiliary parameters The corresponding record for the certificate is In the blockchain ledger storage, each element's key value is... The value is the index of the extended storage, which is actually the hash of the certificate object in the extended storage; Where H is the hash function, w is the private value generated for a client, and i is the index, indicating which session, i=[1,n].

7. The industrial IoT cloud manufacturing security service system according to claim 5, characterized in that, The symmetric key establishment module includes, In the key initialization phase of the manufacturing equipment, during each key exchange process, the IoT node generates a private key based on the auxiliary data stored in the ledger of key exchange i. The cloud node needs to synchronize with counter i and dynamic identity and send the IoT node to the fog node to start the key exchange.

8. The industrial IoT cloud manufacturing security service system according to claim 5, characterized in that, Secure communication channel construction module, including, A Schnorr signature unit, used to sign message M, has a key pair (dn, Qn), where dn is the key and Qn is the public key, and Qn = dn * G, where G is a randomly selected point on an ellipse. The user selects a random value r and calculates... Exported functions H is a one-way collision-resistant hash function, and its signature is defined as follows: The user publicly discloses M, R, and s together, where M is the message, R is the intermediate value for verifying the signature, and s is the signature. Other parameters can be determined using equations. The verification message M is signed by the user using a public key, if the equation... If the result is valid, the verification is considered successful.

Images